Commands / kosa8 audit export

kosa8 audit export

Export the full audit log for a SIEM (--format jsonl|cef)

Writes every audit entry, as newline-delimited JSON or ArcSight CEF.

When anything on this host is labelled — or the log records that something was — the export begins with one marking record: the highest label involved, its banner, and the CUI designation indicator from the org policy ({"kosa8_marking": ...} in jsonl, an export.marking event in CEF). An export of an unlabelled host is unchanged.

--label CUI//SP-EXPT exports only the entries whose structured refs name that classification — as what the entry is about, or as the label a relabel moved it from — and the marking is then that label's. Entries written before audit entries carried refs are not selected; they name no label by value.

Options